Edit

Page

Page title:

Page body:

* 仕様書

[REFS[
- [80] [CITE@en[Secure Contexts]], [TIME[2020-03-30 22:34:37 +09:00]] <https://w3c.github.io/webappsec-secure-contexts/>
-- [82] [CITE@en[Secure Contexts]], [TIME[2020-03-30 22:34:37 +09:00]] <https://w3c.github.io/webappsec-secure-contexts/#framework>
-- [90] [CITE@en[Secure Contexts]], [TIME[2020-03-30 22:34:37 +09:00]] <https://w3c.github.io/webappsec-secure-contexts/#algorithms>
- [78] [CITE@en-US[Push API]], [TIME[2020-02-04 16:21:34 +09:00]] <https://w3c.github.io/push-api/#security-and-privacy-considerations>
]REFS]

* TLS 必須の機能

[25] 次の機能は、原則として[[素のHTTP]] では利用できず、 [[HTTPS]]
でなければならないようになっています。

[FIG(list short)[
- [[Service Workers]]
- [[HTTP/2]]
- [[DeviceOrientation Event]]
- [[Brotli]]
- [[AppCache]]
- [[Push API]]
- [CODE[Geolocation]]
- [CODE[registerProtocolHandler]]
- [CODE[unregisterProtocolHandler]]
]FIG]

[139] 
[CODE[Geolocation]] は当初[[非保安文脈]]にも提供されていましたが、
[[保安文脈]]に制限されました。従来多くの[[素のHTTP]]の
[[Webサイト]]がこれを利用していましたが、
[[セキュリティー]]を[[理由に仕様変更が強行][Web互換性]]されました。

[79] [CITE[Push API]]
は、
[[secure context]]
でのみ提供しなければ[MUST[ならない]]としながら、
開発目的のみこれを無視して良いとしています。
[SRC[>>78]]

[86] 次の機能は、[[保安文脈]]と[[非保安文脈]]をまたいで利用できません。
[[混合内容][Mixed Content]]制約と似ています。

[FIG(short list)[ [87] [[保安文脈]]と[[非保安文脈]]で分断される機能
- [CODE[SharedWorker]]
]FIG]

[138] 一般に新しい機能は[[保安文脈]]でのみ利用可能とすることが好ましいと考えられています。

* 判定

[88] 
[CODE[WindowOrWorkerGlobalScope]]
[[インターフェイス]]の
[DFN[[CODE[isSecureContext]]]]
[[IDL属性]] [SRC[>>82]] の[[取得器]]は、
次のようにしなければ[MUST[なりません]]。

[FIG(steps)[
= [89] 
[[文脈オブジェクト]]の[F[関連設定群オブジェクト]]の[F[文脈的保安]]を返します [SRC[>>82]]。
]FIG]

[83] [[環境設定群オブジェクト]]は、
[F[文脈的保安]]が[[真]]のとき[DFN[[F[[RUBYB[[[保安文脈]]][secure context]]]]]]であり、
[[偽]]のとき[DFN[[F[[RUBYB[[[非保安文脈]]][non-secure context]]]]]]であります。
[SRC[>>82]]

[84] [[大域オブジェクト]]は、
[F[関連設定群オブジェクト]]の[F[文脈的保安]]が[[真]]のとき[F[保安文脈]]であり、
[[偽]]のとき[F[非保安文脈]]であります。
[SRC[>>82]]

-*-*-

[91] [[環境設定群オブジェクト]][VAR[設定群]]が[DFN[[F[[RUBYB[文脈的保安][contextually secure]]]]]]であるか否かは、
次の [DFN[Is settings contextually secure?]]
[[手順群]]によります。
[SRC[>>90]]

[FIG(steps)[
= [92] [VAR[大域]]を、[VAR[設定群]]の[F[大域オブジェクト]]に設定します。
= [93] [VAR[大域]]が [CODE[WorkerGlobalScope]] の場合、
== [94] [VAR[大域]]の[F[所有者集合]]の各[[文書]][VAR[文書]]について、
=== [95] [VAR[文書]]の[F[関連設定群オブジェクト]]の[F[文脈的保安]]が[[偽]]の場合、
==== [96] [[偽]]を返し、ここで停止します。
= [98] それ以外の場合、
== [99] [VAR[文書]]を、[VAR[設定群]]の[F[有責文書]]に設定します。
== [102] [VAR[設定群]]の[F[HTTPS状態]]が [CODE[deprecated][HTTPS状態]] の場合、
=== [101] [[偽]]を返し、ここで停止します。
== [100] [VAR[文書]]の[F[親閲覧文脈]]が [CODE[null]] で''なく''、
[VAR[文書]]の[F[親閲覧文脈]]の[F[活性文書]]の[F[関連設定群オブジェクト]]の[F[文脈的保安]]が[[偽]]の場合、
=== [103] [[偽]]を返し、ここで停止します。
== [104] [VAR[文書]]の[F[活性砂箱化フラグ]]の[F[砂箱化起源閲覧文脈フラグ]]が[[真]]で、
[VAR[設定群]]の[F[作成子URL]]について
[[Is url potentially trustworthy?]]
が
[[Not Trustworthy]]
の場合、
=== [105] [[偽]]を返し、ここで停止します。
== [106] [VAR[文書]]の[F[活性砂箱化フラグ]]の[F[砂箱化起源閲覧文脈フラグ]]が[[偽]]で、
[VAR[設定群]]の[F[起源][環境設定群オブジェクトの起源]]が[[潜在的に信頼できる起源]]で''ない''場合、
=== [107] [[偽]]を返し、ここで停止します。
= [108] [[真]]を返します。

]FIG]

[97] 簡単に言えば[[フレーム]]の包含関係や[[ワーカー]]の生成関係の祖先方向に
1つでも[[保安文脈]]でないものがあれば、[[保安文脈]]ではないと判断されます。

-*-*-

[131] 
[[URL]] [VAR[URL]]
が[DFN[[RUBYB[潜在的に信頼できるURL][potentially trustworthy URL]]]]
であるか否かは、次の[[手順群]]によります。
[SRC[>>90]]

[FIG(steps)[
= [132] 
[VAR[URL]]
が
[CODE[about:blank]]
または
[CODE[about:srcdoc]]
の場合、
== [133] [[真]]を返し、ここで停止します。
= [134] [VAR[URL]] の [F[scheme][URL scheme]] が
[CODE[data][data:]]
の場合、
== [135] [[真]]を返し、ここで停止します。
= [136] [VAR[URL]] の[F[起源][URLの起源]]が[[潜在的に信頼できる起源]]か否かを返します。
]FIG]

;;
[137] [CODE[blob:]] [DEL[や [CODE[filesystem:]]]] のとき、
[[URLの起源]]は作成元の[[起源]]になりますので、その信頼できるかどうかが引き継がれます。

[141] 
[[先験的認証済URL]]の定義からも参照されます。

[109] 
[[起源]][VAR[起源]]が [DFN[[RUBYB[潜在的に信頼できる起源][potentially trustworthy origin]]]]であるか否かは、
次によります。
[SRC[>>90]]

[FIG(steps)[
= [111] [VAR[起源]]が[[不透明起源]]の場合、
== [112] [[偽]]を返し、ここで停止します。
= [113] [VAR[起源]]の[F[scheme][URL scheme]]が [CODE[https][https:]] か 
[CODE[wss][wss:]] の場合、
;; これは [[a priori authenticated URL]] に相当します。
== [114] [[真]]を返し、ここで停止します。
= [115] [VAR[起源]]の[F[ホスト][URL host]]が
[CODE[127.0.0.0/8]]
または
[CODE[::1/128]]
に一致する場合、
== [116] [[真]]を返し、ここで停止します。
= [117] [VAR[起源]]の[F[ホスト][URL host]]が [CODE[localhost]]
であるかまたは [CODE[.localhost]] で終わるものであって、
[[利用者エージェント]]が 
[[let-localhost-be-localhost]] [[名前解決規則]]を使う場合、
== [118] [[真]]を返し、ここで停止します。
= [119] [VAR[起源]]の[F[scheme][URL scheme]]が [CODE[file][file:]] の場合、
== [120] [[真]]を返し、ここで停止します。
= [121] [VAR[起源]]の[F[scheme][URL scheme]]が、
[[利用者エージェントが認証済とみなすURL scheme]]の場合、
== [122] [[真]]を返し、ここで停止します。
= [123] [VAR[起源]]が[[[RUBYB[信頼できる起源][trustworthy origin]]と設定][信頼できる起源の設定]]されている場合、
== [124] [[真]]を返し、ここで停止します。
= [125] [[偽]]を返します。

]FIG]

[110] これが[[真]]であることは、
[[利用者エージェント]]が通常、データを[[保安して配送][保安輸送路]]するものと信頼できることを意味しています。
[SRC[>>90]]

[126] 
[CODE[file:]] について、[[仕様書]]は[[アルゴリズム]]を[[事実の文]]として記述していて、
これを参照している[[アルゴリズム]]が[MUST[必須]]と[[規定]]されているならそれが波及してこの規定も[MUST[必須]]となります。
[[仕様書]]本文にはそれとやや矛盾するとも思われる、
これを[SHOULD[推奨]]とする[[規定]]もあります。
[[利用者エージェント]]は、
ローカルファイルを信頼できないと扱うこともできましょうが、
[[ディスク]]から[[利用者エージェント]]に保安的に輸送された[[資源]]ですし、
[[Web開発者]]の便宜を図るためもあって、
信頼できるとするべきだ [SRC[>>90]] とされます。
しかしながら、リスクがないでもありませんから、
そうした便宜より[[保安性]]を重視する[[利用者エージェント]]は、
[CODE[file:]] を信頼できないとみなしても[MAY[構わない]] [SRC[>>90]]
ともされています。

* [CODE(WebIDL)[SecureContext]] 拡張属性

[85] [[仕様書]]の[[著者]]は、新しい機能を定義する時、
[CODE(WebIDL)[SecureContext]]
とすることが[RUBYB[推奨されます][[[encouraged]]]]。
[SRC[>>82 ([[参考]])]]

* 歴史

** 特別な HTTPS の時代

[147] [CITE[WebKit Page Cache I – The Basics | WebKit]], [TIME[2023-05-18T05:59:22.000Z]] <https://webkit.org/blog/427/webkit-page-cache-i-the-basics/>

>[SNIP[]] As a result, in an effort to err on the side of extreme caution, WebKit has disallowed all HTTPS sites from its Page Cache since the very beginning.

[146] 
[[どこでもはてなスター]]

** 強力機能の制限

[140] 
[[非保安文脈]]への強力な新機能追加の停止は [[Chrome]]
開発チームによって提唱されました。 [SRC[>>2]]

[1] [CITE@en[MIX: Introduce a definiton of 'authenticated origin/environment'. · 5e594d0 · w3c/webappsec]]
( ([TIME[2014-08-24 02:35:27 +09:00]] 版))
<https://github.com/w3c/webappsec/commit/5e594d044ecf9a1b87a082e768adf02bb600bb52>

[2] [CITE[Prefer Secure Origins For Powerful New Features - The Chromium Projects]]
( ([TIME[2014-08-23 19:05:44 +09:00]] 版))
<http://www.chromium.org/Home/chromium-security/prefer-secure-origins-for-powerful-new-features>

[3] [CITE@en[Defining secure-enough origins.]]
( ([[Mike West]] 著, [TIME[2014-08-22 18:37:25 +09:00]] 版))
<http://lists.w3.org/Archives/Public/public-webappsec/2014Aug/0107.html>

[4] [CITE@en[Bug 25972 – Please require a secure origin]]
( ([TIME[2014-08-24 02:47:20 +09:00]] 版))
<https://www.w3.org/Bugs/Public/show_bug.cgi?id=25972>

[5] [CITE@en[MIX: 'data:' and 'javascript:' are not authenticated origins. · c17d4f4 · w3c/webappsec]]
( ([TIME[2014-09-04 13:20:18 +09:00]] 版))
<https://github.com/w3c/webappsec/commit/c17d4f4c2dd33b2d2d280f40b36d79ceef942a15>

[6] [CITE@en[Proposal: Prefer secure origins for powerful new web platform features]]
( ([[Chris Palmer]] 著, [TIME[2014-06-28 07:55:32 +09:00]] 版))
<http://lists.w3.org/Archives/Public/public-webappsec/2014Jun/0222.html>

[7] [CITE@en[Re: Proposal: Prefer secure origins for powerful new web platform features]]
( ([[Chris Palmer]] 著, [TIME[2014-08-22 05:19:16 +09:00]] 版))
<http://lists.w3.org/Archives/Public/public-webappsec/2014Aug/0078.html>

[8] [CITE[IRC logs: freenode / #whatwg / 20140928]]
( ([TIME[2014-09-29 06:53:48 +09:00]] 版))
<http://krijnhoetmer.nl/irc-logs/whatwg/20140928#l-228>

[9] [CITE[IRC logs: freenode / #whatwg / 20141001]]
( ([TIME[2014-10-02 05:57:53 +09:00]] 版))
<http://krijnhoetmer.nl/irc-logs/whatwg/20141001>

[10] [CITE[IRC logs: freenode / #whatwg / 20141031]]
( ([TIME[2014-11-01 03:16:58 +09:00]] 版))
<http://krijnhoetmer.nl/irc-logs/whatwg/20141031#l-377>

[11] [CITE@en[MIX: Rework the 'powerful features' algorithms. · ab1894a · w3c/webappsec]]
( ([TIME[2014-11-01 03:34:46 +09:00]] 版))
<https://github.com/w3c/webappsec/commit/ab1894a2ad9b9155c1d1e5a2281e354f0d30a3ed>

[12] [CITE@en[POWER: Strawman 'powerful features' document. · 3c1b2f6 · w3c/webappsec]]
( ([TIME[2014-11-21 21:04:22 +09:00]] 版))
<https://github.com/w3c/webappsec/commit/3c1b2f63ac14de88dc7ccf3966e5959446d98986>

[13] [CITE@en["Requirements for Powerful Features" strawman.]]
( ([[Mike West]] 著, [TIME[2014-11-20 22:21:50 +09:00]] 版))
<http://lists.w3.org/Archives/Public/public-webappsec/2014Nov/0315.html>

[14] [CITE@en[Requirements for Powerful Features]]
( ([TIME[2014-11-21 20:21:00 +09:00]] 版))
<https://w3c.github.io/webappsec/specs/powerfulfeatures/>

[15] [CITE@en[MIX: Drop powerful features. · 52a9881 · w3c/webappsec]]
( ([TIME[2014-11-25 17:14:22 +09:00]] 版))
<https://github.com/w3c/webappsec/commit/52a9881829877ebe7ee9a7aad340f873d9b99210>

[16] [CITE@en[Requirements for Powerful Features]]
( ([TIME[2014-12-03 11:37:43 +09:00]] 版))
<http://www.w3.org/TR/2014/WD-powerful-features-20141204/>

[17] [CITE@en[Proposal: Marking HTTP As Non-Secure]]
( ([[Chris Palmer]] 著, [TIME[2014-12-13 09:46:34 +09:00]] 版))
<http://lists.w3.org/Archives/Public/public-webappsec/2014Dec/0062.html>

[18] [CITE@en[Privileged context features and JavaScript]]
([[Anne van Kesteren]] 著, [TIME[2015-04-17 14:16:44 +09:00]] 版)
<https://lists.w3.org/Archives/Public/public-webapps/2015AprJun/0142.html>

[19] [CITE@en[Secure Contexts: It's worth taking another look.]]
([[Mike West]] 著, [TIME[2015-09-11 14:15:13 +09:00]] 版)
<https://lists.w3.org/Archives/Public/public-webappsec/2015Sep/0068.html>

[20] [CITE@en[Secure Contexts]]
([TIME[2015-09-30 21:19:01 +09:00]] 版)
<https://w3c.github.io/webappsec-secure-contexts/>

[21] [CITE@en[w3c/webappsec-secure-contexts]]
([TIME[2015-10-06 23:22:24 +09:00]] 版)
<https://github.com/w3c/webappsec-secure-contexts>

[22] [CITE@en[Defining secure global objects. · w3c/webappsec-secure-contexts@d676950]]
([TIME[2015-10-17 11:21:30 +09:00]] 版)
<https://github.com/w3c/webappsec-secure-contexts/commit/d67695029560dd9d635495f973c4c369a39301ee>

[23] [CITE@en[Replace "potentially secure origins" with "secure contexts" · w3c/webappsec-subresource-integrity@b2ee530]]
([TIME[2015-10-30 18:46:33 +09:00]] 版)
<https://github.com/w3c/webappsec-subresource-integrity/commit/b2ee530a405afeeacd4108e7aaeba93da7a9e6ee>

[24] [CITE@en[Discuss the `''''''[''''''SecureContext'''''']''''''` attribute. · w3c/webappsec-secure-contexts@6ad8e91]]
([TIME[2015-12-12 10:51:40 +09:00]] 版)
<https://github.com/w3c/webappsec-secure-contexts/commit/6ad8e91b895bc06415e3e50e9654822989f448ac>

[FIG(quote)[
[FIGCAPTION[
[26] [CITE[Interact with BLE devices on the Web | Web Updates - Google Developers]]
([TIME[2015-12-11 00:48:02 +09:00]] 版)
<https://developers.google.com/web/updates/2015/07/interact-with-ble-devices-on-the-web>
]FIGCAPTION]

> Because the Web Bluetooth API is a powerful new feature added to the Web, Google Chrome aims to make it available only to secure contexts.

]FIG]

[27] [CITE@en[Use ''''''[''''''SecureContext'''''']'''''' before it's cool · whatwg/storage@67fcb15]]
([TIME[2016-04-01 19:38:21 +09:00]] 版)
<https://github.com/whatwg/storage/commit/67fcb1510a03afce89f1542203f783103c0c1407>

[28] [CITE@en[Merge branch 'secure-context' into gh-pages · heycam/webidl@710b36c]]
([TIME[2016-04-13 15:24:58 +09:00]] 版)
<https://github.com/heycam/webidl/commit/710b36c501ffd130bb4e7b9af43d9be4981a6631>

[29] [CITE@en[Secure Contexts]]
([TIME[2016-04-13 16:52:03 +09:00]] 版)
<https://www.w3.org/TR/2016/WD-powerful-features-20160413/>

[FIG(quote)[
[FIGCAPTION[
[30] [CITE@en[Re: '''['''secure-contexts''']''' `*.localhost` + DNS]]
( ([[Mike West]]著, [TIME[2016-05-03 21:08:52 +09:00]]))
<https://lists.w3.org/Archives/Public/public-webappsec/2016May/0009.html>
]FIGCAPTION]

> A better solution, I think, is for browser vendors to provide an override
> mechanism for origins you specifically care about: Chrome
> has `--unsafely-treat-insecure-origin-as-secure="
> http://project.laptop.example.com"`, and I assume Safari, Opera, Firefox,
> and Edge could be prevailed upon to provide similar controls as suggested
> in https://www.w3.org/TR/secure-contexts/#development-environments.

]FIG]

[31] [CITE@en[Remove support for '''['''Constructor''']''' on dictionaries (fixes #109).]]
( ([[Ms2ger]]著, [TIME[2016-04-20 20:34:07 +09:00]]))
<https://github.com/heycam/webidl/commit/1982dc3f17002c07f93b39e22f69846478e4a9e2>

[32] [CITE@en[Clarify recommendation for restricting new features.]]
([[mikewest]]著, [TIME[2016-07-15 13:33:33 +09:00]])
<https://github.com/w3c/webappsec-secure-contexts/commit/f99c8970d432647a23fe65e3913fb5202d4561a9>

[33] [CITE@en[Secure Contexts]]
([TIME[2016-07-18 16:57:33 +09:00]])
<https://www.w3.org/TR/2016/WD-secure-contexts-20160718/>

[34] [CITE@en[Rewrite algorithm to handle sandboxes inside 'http://127.0.0.1/']]
([[mikewest]]著, [TIME[2016-07-19 21:08:23 +09:00]])
<https://github.com/w3c/webappsec-secure-contexts/commit/4e14df58c1148bcb448992d4b579a50f4f881051>

[35] [CITE@en[Secure Contexts]]
([TIME[2016-07-19 21:55:10 +09:00]])
<https://www.w3.org/TR/2016/WD-secure-contexts-20160719/>

[36] [CITE@en[CfC: Transition "Secure Contexts" to CR; deadline August 2nd.]]
([[Mike West]]著, [TIME[2016-07-19 22:21:55 +09:00]])
<https://lists.w3.org/Archives/Public/public-webappsec/2016Jul/0032.html>

[37] [CITE@en[Re: CfC: Transition "Secure Contexts" to CR; deadline August 2nd.]]
([[Mike West]]著, [TIME[2016-08-03 03:51:22 +09:00]])
<https://lists.w3.org/Archives/Public/public-webappsec/2016Aug/0001.html>

[38] [CITE@en[Reference 'Securing the Web']]
([[mikewest]]著, [TIME[2016-08-31 00:43:08 +09:00]])
<https://github.com/w3c/webappsec-secure-contexts/commit/9562a4b1bffe99fff8eca6207234bb672e8233cb>

[39] [CITE@en[Secure Contexts]]
([TIME[2016-09-15 06:13:55 +09:00]])
<https://www.w3.org/TR/2016/CR-secure-contexts-20160915/>

[40] [CITE@en[Adding '''['''SecureContext''']''' extended attribute.]]
([[tobie]]著, [TIME[2016-10-29 18:39:48 +09:00]])
<https://github.com/w3c/sensors/commit/9af53599d8bbe1c1a3bc1df1d3cd1b486bc3c6f3>

[FIG(quote)[
[FIGCAPTION[
[41] [CITE@en[DeviceOrientation Event Specification]]
([TIME[2016-08-19 00:30:43 +09:00]])
<https://w3c.github.io/deviceorientation/spec-source-orientation.html#security-and-privacy>
]FIGCAPTION]

> fire events only on secure browsing contexts '''['''SECURE-CONTEXTS''']''',

]FIG]

[42] [CITE@en[draft-thomson-http-omnomnom-00 - Expiring Aggressively Those HTTP Cookies]]
([TIME[2016-12-26 07:05:01 +09:00]])
<https://tools.ietf.org/html/draft-thomson-http-omnomnom-00>

[43] [CITE@en[Merge pull request #55 from w3c/issue-52-secure-context]]
([[mikewest]]著, [TIME[2017-01-14 15:29:47 +09:00]])
<https://github.com/w3c/webappsec-credential-management/commit/7988cf32aab6b69a1522763cb1911d781ba995fd>

[44] [CITE@en[Deprecations and Removals in Chrome 58  |  Web  |  Google Developers]]
( ([TIME[2017-03-28 01:25:28 +09:00]]))
<https://developers.google.com/web/updates/2017/03/chrome-58-deprecations>

[45] [CITE@en[Google Online Security Blog: Next Steps Toward More Connection Security]]
([TIME[2017-05-04 09:56:34 +09:00]])
<https://security.googleblog.com/2017/04/next-steps-toward-more-connection.html>

[FIG(quote)[
[FIGCAPTION[
[46] [CITE@en[Linked Data Notifications]]
([TIME[2017-05-02 20:42:58 +09:00]])
<https://linkedresearch.org/ldn/#authenticated-inboxes>
]FIGCAPTION]

> Authentication involving token passing must be done over HTTPS.

]FIG]

[47] [CITE@en[Deprecations and Removals in Chrome 60  |  Web  |  Google Developers]]
([TIME[2017-06-15 00:01:43 +09:00]])
<https://developers.google.com/web/updates/2017/06/chrome-60-deprecations>

[48] [CITE@en[mikewest/http-is-https: Post-`forbes.com`, I think we can say that "http" => "https".]]
([TIME[2017-07-20 23:37:38 +09:00]])
<https://github.com/mikewest/http-is-https>

[49] [CITE@ja[Google ウェブマスター向け公式ブログ: Chrome の HTTP 接続におけるセキュリティ強化に向けて]]
([TIME[2017-07-21 13:31:43 +09:00]])
<https://webmaster-ja.googleblog.com/2017/07/next-steps-toward-more-connection.html>

[50] [CITE@en[Merge pull request #284 from beverloo/secure-context]]
([[martinthomson]]著, [TIME[2017-08-22 09:13:14 +09:00]])
<https://github.com/w3c/push-api/commit/976d9161c723eed1e8fea173c8c46215250111f7>

[51] [CITE@en[Merge pull request #109 from andrey-logvinov/restrict-to-secure-context]]
([[andrey-logvinov]]著, [TIME[2017-08-24 17:44:16 +09:00]])
<https://github.com/w3c/wake-lock/commit/8dbbf28db9456cb13dbdf289e4d4ec1e094f406e>

[52] [CITE@en[Restrict Wake Lock API to secure context by andrey-logvinov · Pull Request #109 · w3c/wake-lock]]
([TIME[2017-08-25 10:32:30 +09:00]])
<https://github.com/w3c/wake-lock/pull/109>

[53] [CITE@en[Deprecations and Removals in Chrome 61  |  Web  |  Google Developers]]
([TIME[2017-08-16 00:56:37 +09:00]])
<https://developers.google.com/web/updates/2017/08/chrome-61-deprecations>

[FIG(quote)[
[FIGCAPTION[
[54] [CITE@en[RFC 3744 - Web Distributed Authoring and Versioning (WebDAV) Access Control Protocol]]
([TIME[2017-09-24 17:45:41 +09:00]])
<https://tools.ietf.org/html/rfc3744#section-13>
]FIGCAPTION]

>    Implementation of the ACL spec requires that Basic authentication, if
>    used, MUST only be supported over secure transport such as TLS.

]FIG]

[55] [CITE@en[Remove the 'opener' restriction.]]
([[mikewest]]著, [TIME[2017-10-18 16:20:30 +09:00]])
<https://github.com/w3c/webappsec-secure-contexts/commit/98f2c2634f7371bca6ffacbf73e984b22af521ab>

[56] [CITE@en[Should opener be taken into consideration when determining if a context is secure? · Issue #42 · w3c/webappsec-secure-contexts]]
([TIME[2017-10-19 12:25:22 +09:00]])
<https://github.com/w3c/webappsec-secure-contexts/issues/42>

[57] [CITE@en[Cleaning up algorithms and issues.]]
([[mikewest]]著, [TIME[2017-10-18 15:59:03 +09:00]])
<https://github.com/w3c/webappsec-secure-contexts/commit/2cc0b2f634b5062f82d540349233d30cab84e0c3>

[58] [CITE@en[Merge pull request #315 from pozdnyakov/remove_explicit_secure_contex…]]
([[pozdnyakov]]著, [TIME[2017-10-18 18:25:50 +09:00]])
<https://github.com/w3c/sensors/commit/74e879fb672965a527505be048b0a1abc8218ae9>

[59] [CITE@en[Remove the extra secure context check by pozdnyakov · Pull Request #315 · w3c/sensors]]
([TIME[2017-10-19 12:33:02 +09:00]])
<https://github.com/w3c/sensors/pull/315>

[60] [CITE@en[Editorial: Clarifying secure context integration with Shared Workers]]
([[mikewest]]著, [TIME[2017-11-21 00:18:56 +09:00]])
<https://github.com/whatwg/html/commit/6f9d81839133072355c15efa4b934beaf85ea259>

[61] [CITE@en[Editorial: Clarifying secure context integration with Shared Workers. by mikewest · Pull Request #3243 · whatwg/html]]
([TIME[2017-11-25 00:30:00 +09:00]])
<https://github.com/whatwg/html/pull/3243>

[62] [CITE@en[Add support for interface mixins]]
([[tobie]]著, [TIME[2017-10-11 16:48:12 +09:00]])
<https://github.com/heycam/webidl/commit/45e8173d40ddff8dcf81697326e094bcf8b92920>

[63] [CITE@en[What is the expected interaction of '''['''SecureContext''']''' with mixins? · Issue #118 · heycam/webidl]]
([TIME[2017-12-23 15:25:40 +09:00]])
<https://github.com/heycam/webidl/issues/118>

[64] [CITE@en-US[Secure Contexts Everywhere | Mozilla Security Blog]]
([TIME[2018-01-24 13:21:48 +09:00]])
<https://blog.mozilla.org/security/2018/01/15/secure-contexts-everywhere/>

[65] [CITE@en[Reintroduce the dependency on a parent's security. (#55)]]
([[@bzbarsky]]著, [TIME[2018-03-02 04:44:13 +09:00]])
<https://github.com/w3c/webappsec-secure-contexts/commit/322bd8fa3dfde726715776e93787d2e76eeb320f>

[66] [CITE@en[Should secure iframes of insecure parents be considered secure? Spec is self-contradictory. · Issue #54 · w3c/webappsec-secure-contexts]]
([TIME[2018-03-02 18:13:49 +09:00]])
<https://github.com/w3c/webappsec-secure-contexts/issues/54>

[67] [CITE@en[Reintroduce the dependency on a parent's security. by mikewest · Pull Request #55 · w3c/webappsec-secure-contexts]]
([TIME[2018-03-02 18:14:10 +09:00]])
<https://github.com/w3c/webappsec-secure-contexts/pull/55>

[68] [CITE@ja[Google Developers Japan: ウェブ上の安全なアプリのホーム、.app のご紹介]]
([TIME[2018-05-08 16:14:17 +09:00]])
<https://developers-jp.googleblog.com/2018/05/introducing-app-more-secure-home-for.html>

[69] [CITE@en[Deprecations and removals in Chrome 69  |  Web  |  Google Developers]]
([TIME[2018-09-15 02:56:15 +09:00]])
<https://developers.google.com/web/updates/2018/09/chrome-70-deps-rems>

[70] [CITE@en-US[Deprecating Non-Secure HTTP | Mozilla Security Blog]]
([TIME[2018-09-26 00:59:52 +09:00]])
<https://blog.mozilla.org/security/2015/04/30/deprecating-non-secure-http/>

[71] [CITE@en[Restrict application caches to secure contexts]]
([[annevk]]著, [TIME[2018-11-10 06:46:16 +09:00]])
<https://github.com/whatwg/html/commit/81344cc9f567bfafaed57805fd9cdf9f4a4237bf>

[72] [CITE@en[Clarify the restrictions on SecureContext combinations. (#763)]]
([[Ms2ger]]著, [TIME[2019-08-06 22:58:46 +09:00]])
<https://github.com/heycam/webidl/commit/5c57dc1688fb13ca57015c956b0326b6ef71e637>

[73] [CITE@en[Clarify the restrictions on SecureContext combinations. by Ms2ger · Pull Request #763 · heycam/webidl]]
([TIME[2020-01-12 16:34:31 +09:00]])
<https://github.com/heycam/webidl/pull/763>

[74] [CITE@en['''['''SecureContext''']''' handling for mixins seems to be slightly broken · Issue #762 · heycam/webidl]]
([TIME[2020-01-12 16:34:42 +09:00]])
<https://github.com/heycam/webidl/issues/762>

[75] [CITE@en[Clarify the relation between the secure context definitions.]]
([[Ms2ger]]著, [TIME[2019-08-31 00:46:28 +09:00]])
<https://github.com/heycam/webidl/commit/fa38f6cc151c7fbf4ecbfb47ce67e13882519b3d>

[76] [CITE@en[Clarify the relation between the secure context definitions. by Ms2ger · Pull Request #785 · heycam/webidl]]
([TIME[2020-01-12 17:12:34 +09:00]])
<https://github.com/heycam/webidl/pull/785>

[77] [CITE@en[Add async_iterable support]]
([[Ms2ger]]著, [TIME[2019-04-29 19:52:51 +09:00]])
<https://github.com/heycam/webidl/commit/d6caf50f9e21b467dfe54ee37b443f96c09f7333>

[81] [CITE@en[w3c/webappsec-secure-contexts: WebAppSec Secure Contexts]]
([TIME[2020-04-19 20:15:17 +09:00]])
<https://github.com/w3c/webappsec-secure-contexts>

[127] [CITE@en[SECURE:APIを紹介します。 ・W3C / webappsec @ 7dc0655]]
([TIME[2015-09-12 14:45:43 +09:00]] 版)
<https://github.com/w3c/webappsec/commit/7dc065520e76668ef87111780ce2762629581ee9>

[128] [CITE@en[SECURE: Use the getter's global · w3c/webappsec@0bf1021]]
([TIME[2015-09-12 14:46:11 +09:00]] 版)
<https://github.com/w3c/webappsec/commit/0bf1021910b54268d7efc2ecdb874f00ec49a4e4>

[129] [CITE@en[Update 'isSecureContext' definition.]]
([[@domenic]]著, [TIME[2016-07-15 17:37:06 +09:00]])
<https://github.com/w3c/webappsec-secure-contexts/commit/040600a350763ea0fdf679df2f9eff7cdc2343aa>

[130] [CITE@en[Cleaning up algorithms and issues.]]
([[mikewest]]著, [TIME[2017-10-18 15:59:03 +09:00]])
<https://github.com/w3c/webappsec-secure-contexts/commit/2cc0b2f634b5062f82d540349233d30cab84e0c3>

[142] [CITE@en[Restrict (un)registerProtocolHandler to secure contexts]]
([[ericlaw1979]], [TIME[2019-11-20 03:44:22 +09:00]], [TIME[2021-03-17T09:35:12.000Z]])
<https://github.com/whatwg/html/commit/6772a0342e6ffebc922c60c770dce87371b6c968>

[143] [CITE@en[Add SecureContext limitation for '''['''un''']'''registerProtocolHandler API by ericlaw1979 · Pull Request #5080 · whatwg/html]]
([TIME[2021-03-17T09:42:59.000Z]])
<https://github.com/whatwg/html/pull/5080>

[144] [CITE@en[Secure contexts · Issue #23 · WICG/uuid]]
([TIME[2021-04-27T05:17:02.000Z]])
<https://github.com/WICG/uuid/issues/23>

[145] [CITE@en[should URLPattern require a SecureContext? · Issue #29 · WICG/urlpattern]]
([TIME[2021-04-27T05:17:25.000Z]])
<https://github.com/WICG/urlpattern/issues/29>

[148] 最近の [[Chrome]] は[[シークレットウィンドウ]]で [CODE[http:]] へ [[navigate]] するとその旨のエラー画面を表示し、そこでボタンを押すと実際に [[navigate]] します。[[再読込]]や同じ[[起源]]の [[navigate]] でも、必ずではないものの高確率で (条件不明) 同じエラー画面を表示します。うざすぎます。リスクを受け入れる選択をした[[利用者]]に対する使いづらさのバランスが悪いですね。 [TIME[2025-08-18T02:49:43.600Z]]

Historical Legal Sensitive Parent: [Help / License]

Edit

Page

Page name(s)